2951d19e3fc24d23a125cfce83741e0f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2951d19e3fc24d23a125cfce83741e0f_JaffaCakes118
Size

8.7MB
MD5

2951d19e3fc24d23a125cfce83741e0f
SHA1

41b50478601865f245c5365e5eb7d7073b849ab1
SHA256

e985de8f7a898b5916c5fc8174a127aff8773cba10935ebcbb6977c4d9246438
SHA512

7701f45872038ffb6f5d56832284ba6af6975b0a36c12800c3065646a5fa79e4e17b89793669f46529831c1801b496b29a2c6f728ca6471c7a9465ac9be78c05
SSDEEP

196608:FvLhhQrWjFP4A7wbYFXZDfjTVC5EBSoAViNEbE3WluNjztNsJk45C9S3Oeo/:FzhhqGyAMmDfvAsSoA++0NjBNsG45C9B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/wke.dll

Files

2951d19e3fc24d23a125cfce83741e0f_JaffaCakes118
.exe windows:5 windows x86 arch:x86

32f3282581436269b3a75b6675fe3e08

Code Sign

13:8e:17:6f:58:c0:ad:eb:52:37:57:e5:f6:38:57:1a
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

15/06/2016, 02:19

Not After

15/09/2019, 02:19

Subject

CN=北京蓝叠科技有限公司,O=北京蓝叠科技有限公司,L=北京市,ST=北京市,C=CN,1.2.840.113549.1.9.1=#0c12616d7940626c7565737461636b732e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3a:de:c4:02:27:0b:f4:ee:9e:89:2c:c6:5e:0a:da:21
Certificate

Issuer

CN=CA 沃通根证书,O=WoSign CA Limited,C=CN

Not Before

10/07/2015, 00:58

Not After

10/07/2025, 00:58

Subject

CN=CA 沃通 EV 代码签名证书,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:03:26:71:e6:33:9f:cc:9f:4b:51:df:ea:05:0c:6d
Certificate

Issuer

CN=CA 沃通 EV 代码签名证书,O=WoSign CA Limited,C=CN

Not Before

15/06/2016, 02:16

Not After

15/09/2019, 02:16

Subject

SERIALNUMBER=110000450266341,CN=北京蓝叠科技有限公司,O=北京蓝叠科技有限公司,POSTALCODE=100191,STREET=北京市海淀区花园路2号牡丹创业楼2204室,L=北京市,ST=北京市,C=CN,1.2.840.113549.1.9.1=#0c12616d7940626c7565737461636b732e636f6d,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6a:8d:17:2f:fa:f6:4a:d6:ec:13:1d:05:b7:a8:95:bc:62:e5:e3:82:50:a7:a1:6f:ab:b7:ef:ea:39:f6:46:a1
Signer

Actual PE Digest

6a:8d:17:2f:fa:f6:4a:d6:ec:13:1d:05:b7:a8:95:bc:62:e5:e3:82:50:a7:a1:6f:ab:b7:ef:ea:39:f6:46:a1

Digest Algorithm

sha256

PE Digest Matches

true

71:ae:e0:44:be:36:dd:22:b6:46:e7:e7:08:58:35:7a:bc:74:cc:55
Signer

Actual PE Digest

71:ae:e0:44:be:36:dd:22:b6:46:e7:e7:08:58:35:7a:bc:74:cc:55

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 415KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 708KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 350KB - Virtual size: 350KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/setupdll.dll
.dll windows:5 windows x86 arch:x86

4e8bba296511756970778b3728d39385

Code Sign

13:8e:17:6f:58:c0:ad:eb:52:37:57:e5:f6:38:57:1a
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

15/06/2016, 02:19

Not After

15/09/2019, 02:19

Subject

CN=北京蓝叠科技有限公司,O=北京蓝叠科技有限公司,L=北京市,ST=北京市,C=CN,1.2.840.113549.1.9.1=#0c12616d7940626c7565737461636b732e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3a:de:c4:02:27:0b:f4:ee:9e:89:2c:c6:5e:0a:da:21
Certificate

Issuer

CN=CA 沃通根证书,O=WoSign CA Limited,C=CN

Not Before

10/07/2015, 00:58

Not After

10/07/2025, 00:58

Subject

CN=CA 沃通 EV 代码签名证书,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:03:26:71:e6:33:9f:cc:9f:4b:51:df:ea:05:0c:6d
Certificate

Issuer

CN=CA 沃通 EV 代码签名证书,O=WoSign CA Limited,C=CN

Not Before

15/06/2016, 02:16

Not After

15/09/2019, 02:16

Subject

SERIALNUMBER=110000450266341,CN=北京蓝叠科技有限公司,O=北京蓝叠科技有限公司,POSTALCODE=100191,STREET=北京市海淀区花园路2号牡丹创业楼2204室,L=北京市,ST=北京市,C=CN,1.2.840.113549.1.9.1=#0c12616d7940626c7565737461636b732e636f6d,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

98:c9:05:b7:8c:7b:9d:bf:05:f7:90:ed:56:17:70:fe:97:01:71:7a:e5:33:cf:cd:eb:3b:51:64:a5:e5:e9:e8
Signer

Actual PE Digest

98:c9:05:b7:8c:7b:9d:bf:05:f7:90:ed:56:17:70:fe:97:01:71:7a:e5:33:cf:cd:eb:3b:51:64:a5:e5:e9:e8

Digest Algorithm

sha256

PE Digest Matches

true

99:26:fd:bf:82:23:6c:ba:7c:d1:21:49:cc:56:58:ac:79:ba:d7:dd
Signer

Actual PE Digest

99:26:fd:bf:82:23:6c:ba:7c:d1:21:49:cc:56:58:ac:79:ba:d7:dd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\bschina\bin\setupdll.pdb

Imports

kernel32

VerifyVersionInfoA
WaitForMultipleObjects
GetFileType
GetStdHandle
ReadFile
PeekNamedPipe
ExpandEnvironmentStringsA
GetSystemDirectoryA
VerSetConditionMask
SleepEx
FormatMessageA
GetModuleHandleA
LoadLibraryA
GetVersionExA
MulDiv
GetFullPathNameW
FindResourceW
SizeofResource
LoadResource
LockResource
FreeResource
HeapDestroy
HeapCreate
FlushInstructionCache
LoadLibraryExW
DeviceIoControl
GetVolumeInformationA
MultiByteToWideChar
GlobalAlloc
GlobalFree
DecodePointer
RaiseException
SetEvent
CreateEventW
InitializeCriticalSectionAndSpinCount
SetEndOfFile
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetCurrentDirectoryW
SetStdHandle
FlushFileBuffers
GetTimeZoneInformation
EnumSystemLocalesW
lstrcpynW
IsValidLocale
GetACP
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetModuleFileNameA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
SetFilePointerEx
MoveFileExW
GetModuleHandleExW
ExitThread
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualProtect
VirtualFree
VirtualAlloc
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
OutputDebugStringW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
ResetEvent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
lstrcpyW
SetCurrentDirectoryW
GlobalMemoryStatusEx
WideCharToMultiByte
GetDiskFreeSpaceExW
ExitProcess
SetFilePointer
GetCurrentProcess
CopyFileW
CreateDirectoryW
SetLastError
Sleep
WriteFile
GetTempFileNameW
GetTempPathW
FreeLibrary
LoadLibraryW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetFileSize
CreateFileW
GetCommandLineW
GetTickCount
GetModuleFileNameW
InterlockedIncrement
GetProcAddress
GetModuleHandleW
RemoveDirectoryW
FindClose
FindNextFileW
SetFileAttributesW
FindFirstFileW
DeleteFileW
GetFileAttributesW
GetLastError
GetVersionExW
Process32NextW
TerminateProcess
OpenProcess
Process32FirstW
GetCurrentProcessId
CreateToolhelp32Snapshot
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
HeapSize
HeapReAlloc
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
QueryPerformanceCounter
EncodePointer
TryEnterCriticalSection
GetCurrentThreadId
GetCurrentThread
WaitForSingleObjectEx
DuplicateHandle
GetStringTypeW
GlobalUnlock
GlobalLock
LocalFree
CloseHandle
InterlockedDecrement
HeapFree
GetProcessHeap
GetUserDefaultLCID
HeapAlloc

user32

GetWindow
MessageBoxW
CallWindowProcW
SetWindowLongW
GetDesktopWindow
PostQuitMessage
TranslateMessage
IsWindowEnabled
SetActiveWindow
DispatchMessageW
RegisterClassExW
UnregisterClassW
DrawIconEx
InvertRect
FillRect
CreateWindowExW
DestroyWindow
DefWindowProcW
GetMessageW
wsprintfW
SetTimer
KillTimer
SetCursor
SetRect
InflateRect
LoadBitmapW
CreateIconFromResource
GetWindowLongW
GetWindowRect
GetCursorPos
IntersectRect
UnionRect
IsRectEmpty
EqualRect
PtInRect
CharNextW
OffsetRect
DestroyIcon
GetIconInfo
LoadCursorW
DestroyCursor
GetDlgItem
TrackMouseEvent
IsWindow
AnimateWindow
SetLayeredWindowAttributes
IsZoomed
SetFocus
GetCapture
SetCapture
ReleaseCapture
UpdateWindow
GetDC
ReleaseDC
BeginPaint
EndPaint
InvalidateRect
SetWindowTextW
PostMessageW
SendMessageW
GetParent
GetClientRect
MapWindowPoints
SetWindowPos
ShowWindow
GetActiveWindow
FindWindowExW
CopyRect
MonitorFromPoint
MonitorFromWindow
GetMonitorInfoW
EnableWindow
GetFocus
LoadIconW
CreateCaret
GetCaretBlinkTime
HideCaret
SetCaretPos
ScreenToClient
GetClassNameW
IsMenu
CreatePopupMenu
DestroyMenu
GetSysColor
SetForegroundWindow
LoadImageW
GetMenuItemInfoW
TrackPopupMenu
AppendMenuW
IsIconic
UpdateLayeredWindow
SystemParametersInfoA
DrawTextW
GetSystemMetrics
IsWindowVisible
ClientToScreen
EnableMenuItem
GetKeyState
PeekMessageW
MapVirtualKeyA
CharLowerBuffW
GetMenuItemCount

gdi32

GetCurrentObject
Polyline
CreateDIBSection
SetViewportOrgEx
CreateCompatibleBitmap
CreateRoundRectRgn
CreateBitmap
StretchBlt
DeleteDC
CreateCompatibleDC
GetViewportOrgEx
SetBkMode
SelectObject
Rectangle
GetClipBox
CreateSolidBrush
CreateFontIndirectW
SetGraphicsMode
GetDeviceCaps
GetObjectW
GetStockObject
EnumFontsW
BitBlt
DeleteObject
SetWorldTransform
Arc
Chord
CombineRgn
CreatePen
CreatePatternBrush
CreateRectRgn
CreateRectRgnIndirect
Ellipse
ExcludeClipRect
GetClipRgn
GetRgnBox
GetTextColor
GetTextExtentPoint32W
IntersectClipRect
OffsetRgn
PtInRegion
RectInRegion
RestoreDC
RoundRect
SaveDC
ExtSelectClipRgn
SetRectRgn
SetTextColor
GetWorldTransform

advapi32

RegOpenKeyExA
GetTokenInformation
RegCreateKeyW
RegSetValueW
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegQueryValueExA
OpenProcessToken
RegEnumKeyExA
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey

shell32

SHGetPathFromIDListW
ord165
SHGetDataFromIDListW
SHGetDesktopFolder
SHGetSpecialFolderPathW
SHBrowseForFolderW
ShellExecuteW

ole32

CreateBindCtx
OleLockRunning
CLSIDFromString
OleInitialize
CoTaskMemFree
CreateStreamOnHGlobal
IIDFromString
OleUninitialize
CoUninitialize
CoInitialize
CoCreateInstance
CLSIDFromProgID

oleaut32

VariantClear
SysAllocString
SysFreeString
GetErrorInfo
VariantInit

shlwapi

StrToIntExW
PathFileExistsW
PathRemoveFileSpecW
PathFindFileNameW
PathRemoveExtensionW
PathAddExtensionW
ord176
PathAppendW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

ws2_32

socket
WSAIoctl
getaddrinfo
freeaddrinfo
accept
listen
setsockopt
sendto
ioctlsocket
gethostname
htonl
ntohl
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
recv
WSASetLastError
select
__WSAFDIsSet
WSAStartup
WSAGetLastError
WSACleanup
recvfrom

iphlpapi

GetAdaptersInfo

wldap32

ord33
ord27
ord32
ord35
ord79
ord30
ord200
ord301
ord22
ord41
ord50
ord60
ord211
ord46
ord143
ord26

crypt32

CertFreeCertificateContext

imm32

ImmReleaseContext
ImmGetContext

gdiplus

GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipGraphicsClear
GdipDrawImageRectI
GdipGetImageEncodersSize
GdipGetImageEncoders

msimg32

GradientFill
AlphaBlend

Exports

Exports

?GetElevationType@@YAJPAW4_TOKEN_ELEVATION_TYPE@@@Z
?IsElevated@@YAJPAH@Z
?IsVista@@YAHXZ
?IsWow64@@YAHXZ
BackupAppData
BindControlAndNSISScript
BindingProgress
CheckExistVersion
CheckRunningBS
CheckSetupMode
ClearAllShortcut
ClosePage
CreateBCGPShortcut
FindChildByName
FindStringByName
GetCommandLineValueByKey
GetControlProperties
GetEngineRegValue
GetMainExeLaunchCmd
GetPreConfigTxt
GetStringTranslate
InitWindow
InstallEngine
NSISMessageBox
NSISOpenFolderDialog
NSISScriptSendMessage
PostApkCheck
PreApkCheck
PreEngineCheck
PreInstallCheck
PreSpecialCheck
RestoreKeepAppData
SetControlProperties
SetSetupMode
SetupInstallStat
ShellExecAsUser
ShouldRewriteTN
ShouldShowRewrite
ShowPage
WriteCompaignMd5
WriteFeatureList

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 252KB - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/uires/image/close2.png
.png
$PLUGINSDIR/uires/image/colorbtn.png
.png
$PLUGINSDIR/uires/image/inst_pro_bar.png
.png
$PLUGINSDIR/uires/image/inst_pro_bg.png
.png
$PLUGINSDIR/uires/image/logo.ico
$PLUGINSDIR/uires/image/logo24.png
.png
$PLUGINSDIR/uires/image/msg_excl.ico
$PLUGINSDIR/uires/image/msg_info.ico
$PLUGINSDIR/uires/image/msg_ques.ico
$PLUGINSDIR/uires/image/msgboxbg.png
.png
$PLUGINSDIR/uires/xml/msgbox.xml
BluestacksGP.exe
.exe windows:5 windows x86 arch:x86

59e604ac4326a5df81f185881438f8b3

Code Sign

13:8e:17:6f:58:c0:ad:eb:52:37:57:e5:f6:38:57:1a
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

15/06/2016, 02:19

Not After

15/09/2019, 02:19

Subject

CN=北京蓝叠科技有限公司,O=北京蓝叠科技有限公司,L=北京市,ST=北京市,C=CN,1.2.840.113549.1.9.1=#0c12616d7940626c7565737461636b732e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3a:de:c4:02:27:0b:f4:ee:9e:89:2c:c6:5e:0a:da:21
Certificate

Issuer

CN=CA 沃通根证书,O=WoSign CA Limited,C=CN

Not Before

10/07/2015, 00:58

Not After

10/07/2025, 00:58

Subject

CN=CA 沃通 EV 代码签名证书,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:03:26:71:e6:33:9f:cc:9f:4b:51:df:ea:05:0c:6d
Certificate

Issuer

CN=CA 沃通 EV 代码签名证书,O=WoSign CA Limited,C=CN

Not Before

15/06/2016, 02:16

Not After

15/09/2019, 02:16

Subject

SERIALNUMBER=110000450266341,CN=北京蓝叠科技有限公司,O=北京蓝叠科技有限公司,POSTALCODE=100191,STREET=北京市海淀区花园路2号牡丹创业楼2204室,L=北京市,ST=北京市,C=CN,1.2.840.113549.1.9.1=#0c12616d7940626c7565737461636b732e636f6d,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

19:c5:e6:d7:57:50:3c:49:fb:d1:05:40:b7:4f:0d:c5:02:32:87:99:18:53:0d:75:92:c7:24:56:e1:ce:9d:31
Signer

Actual PE Digest

19:c5:e6:d7:57:50:3c:49:fb:d1:05:40:b7:4f:0d:c5:02:32:87:99:18:53:0d:75:92:c7:24:56:e1:ce:9d:31

Digest Algorithm

sha256

PE Digest Matches

true

00:f7:d3:58:68:16:5e:ad:8b:e4:b8:66:1e:b2:ff:cf:0d:62:3e:6c
Signer

Actual PE Digest

00:f7:d3:58:68:16:5e:ad:8b:e4:b8:66:1e:b2:ff:cf:0d:62:3e:6c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\bschina\bin\BluestacksGP.pdb

Imports

wke

jsDouble
jsSet
jsObject
jsNull
jsStringW
jsIsNumber
jsToBoolean
jsIsBoolean
jsGetAt
jsGetLength
jsIsArray
jsToInt
jsInt
jsGet
jsIsObject
jsToString
jsIsString
jsBoolean
jsArg
jsToStringW
jsToDouble
jsBindFunction

kernel32

FreeResource
LockResource
LoadResource
SizeofResource
FindResourceW
GetFullPathNameW
HeapCreate
HeapDestroy
MulDiv
GetVersionExA
LoadLibraryA
GetModuleHandleA
FormatMessageA
SleepEx
VerSetConditionMask
GetSystemDirectoryA
VerifyVersionInfoA
WaitForMultipleObjects
GetFileType
GetStdHandle
ReadFile
PeekNamedPipe
ExpandEnvironmentStringsA
LoadLibraryExW
GetVolumeInformationA
GlobalFree
MultiByteToWideChar
MoveFileExW
GetModuleFileNameA
GlobalDeleteAtom
GlobalAddAtomW
FlushInstructionCache
SystemTimeToFileTime
SetThreadExecutionState
FindCloseChangeNotification
FindNextChangeNotification
UnregisterWaitEx
QueryDepthSList
VirtualProtect
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
WriteConsoleW
OutputDebugStringW
FreeEnvironmentStringsW
FindFirstChangeNotificationW
GetCommandLineA
GetOEMCP
IsValidCodePage
SetStdHandle
CreateProcessA
GetTimeZoneInformation
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
SetEnvironmentVariableA
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetACP
ExitProcess
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
RtlUnwind
InterlockedFlushSList
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
DeviceIoControl
HeapSize
HeapReAlloc
FindResourceExW
VirtualFree
VirtualAlloc
InterlockedPushEntrySList
InterlockedPopEntrySList
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
EncodePointer
AreFileApisANSI
CreateHardLinkW
SetFilePointerEx
SetEndOfFile
GetFileInformationByHandle
GetFileAttributesExW
FindFirstFileExW
GetStringTypeW
TryEnterCriticalSection
GetCurrentThread
DuplicateHandle
FormatMessageW
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetFilePointer
SetCurrentDirectoryW
CreateMutexW
GetProcessId
GetSystemInfo
GlobalMemoryStatusEx
GetExitCodeThread
GetSystemTime
IsWow64Process
CopyFileW
CreateDirectoryW
SetLastError
WriteFile
GetTempFileNameW
GetTempPathW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetCommandLineW
GetModuleHandleW
RemoveDirectoryW
FindClose
FindNextFileW
SetFileAttributesW
FindFirstFileW
GetFileAttributesW
HeapFree
GetProcessHeap
HeapAlloc
GetLastError
GetVersionExW
TerminateProcess
OpenProcess
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
lstrlenW
GetCurrentProcess
GetCurrentThreadId
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentProcessId
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetFileSize
CreateFileW
GetCurrentDirectoryW
CloseHandle
DeleteFileW
Sleep
GetProcAddress
LoadLibraryW
FreeLibrary
WideCharToMultiByte
GetTickCount
GlobalUnlock
GlobalLock
GlobalAlloc
SetEvent
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
CreateDirectoryA
GetModuleHandleExA
CreateSemaphoreW
GetSystemTimeAsFileTime
ReleaseSemaphore
LocalFree
InterlockedIncrement
InterlockedDecrement
GetEnvironmentStringsW

user32

FindWindowExW
IsWindowVisible
SetRect
DefWindowProcW
RegisterClassExW
CreateWindowExW
SetTimer
KillTimer
GetClientRect
FillRect
FindWindowW
IsIconic
GetWindowDC
ReleaseDC
InvalidateRect
WaitForInputIdle
GetMonitorInfoW
MonitorFromWindow
MonitorFromPoint
CopyRect
MapWindowPoints
GetParent
GetActiveWindow
GetWindow
BringWindowToTop
SetForegroundWindow
EnumChildWindows
SetParent
PostQuitMessage
AnimateWindow
GetWindowPlacement
SystemParametersInfoW
SetWindowPlacement
SetWindowsHookExW
UnhookWindowsHookEx
SetFocus
CallNextHookEx
GetForegroundWindow
SetWindowTextW
IsRectEmpty
GetDC
GetDesktopWindow
wsprintfW
GetClipboardData
CloseClipboard
RegisterHotKey
UnregisterHotKey
EnumWindows
SetCursor
InflateRect
UnionRect
EqualRect
LoadCursorW
DestroyCursor
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
MsgWaitForMultipleObjects
CharNextW
DestroyIcon
GetIconInfo
LoadBitmapW
CreateIconFromResource
LoadImageW
MessageBoxW
LoadIconW
SetWindowPos
CallWindowProcW
UnregisterClassW
GetDlgItem
TrackMouseEvent
SetLayeredWindowAttributes
GetCapture
SetCapture
ReleaseCapture
UpdateWindow
BeginPaint
EndPaint
CreateCaret
GetCaretBlinkTime
HideCaret
SetCaretPos
GetClassNameW
EnableWindow
MoveWindow
IsZoomed
GetSystemMetrics
GetWindowRect
InvertRect
DrawIconEx
SetWindowLongW
OpenClipboard
GetFocus
OffsetRect
GetCursorPos
ClientToScreen
IntersectRect
PostMessageW
PtInRect
ShowWindow
ScreenToClient
SendMessageW
IsWindow
DestroyWindow
UpdateLayeredWindow
GetMenuItemInfoW
TrackPopupMenu
AppendMenuW
GetMenuItemCount
DestroyMenu
CreatePopupMenu
MapVirtualKeyA
CharLowerBuffW
SystemParametersInfoA
DrawTextW
GetSysColor
EnableMenuItem
GetKeyState
IsWindowEnabled
SetActiveWindow
GetWindowLongW

gdi32

CreatePen
CreatePatternBrush
CreateRectRgn
GetTextColor
GetTextExtentPoint32W
IntersectClipRect
OffsetRgn
PtInRegion
RectInRegion
RestoreDC
CombineRgn
SaveDC
ExtSelectClipRgn
SetRectRgn
GetRgnBox
SetTextColor
GetWorldTransform
SetWorldTransform
CreateDIBSection
Polyline
GetViewportOrgEx
Arc
CreateRectRgnIndirect
Ellipse
ExcludeClipRect
GetClipRgn
Chord
RoundRect
GetCurrentObject
SetViewportOrgEx
CreateBitmap
CreateRoundRectRgn
SetBkMode
Rectangle
GetClipBox
CreateFontIndirectW
GetObjectW
GetStockObject
EnumFontsW
SetGraphicsMode
GetDeviceCaps
StretchBlt
CreateSolidBrush
DeleteObject
DeleteDC
BitBlt
SelectObject
SetBitmapBits
CreateCompatibleDC
CreateCompatibleBitmap

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

RegQueryValueExW
OpenProcessToken
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
RegCreateKeyW
RegSetValueW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt

shell32

ShellExecuteA
ShellExecuteW
SHGetSpecialFolderPathW
SHGetDataFromIDListW
ord165
DragAcceptFiles
DragQueryFileW
DragFinish
SHGetDesktopFolder

ole32

CreateStreamOnHGlobal
CoCreateGuid
CoInitialize
CoCreateInstance
CoUninitialize
OleInitialize
OleUninitialize
CLSIDFromString
CLSIDFromProgID
OleLockRunning
CreateBindCtx
IIDFromString

oleaut32

SysFreeString
SysAllocString
GetErrorInfo

shlwapi

PathIsDirectoryA
PathAppendW
PathFileExistsW
PathRemoveFileSpecW
PathFindFileNameW
PathRemoveExtensionW
PathAddExtensionW
PathFindExtensionW
StrToIntExW

gdiplus

GdipAlloc
GdipDisposeImage
GdipFree
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageI
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectI
GdipGraphicsClear
GdipSaveImageToFile
GdiplusShutdown
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext

msimg32

GradientFill
AlphaBlend

winhttp

WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpConnect
WinHttpAddRequestHeaders
WinHttpCloseHandle
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpOpen

avicap32

capGetDriverDescriptionW

ws2_32

accept
getaddrinfo
WSAIoctl
setsockopt
getsockopt
getsockname
getpeername
listen
WSASetLastError
select
__WSAFDIsSet
WSAGetLastError
ntohl
htonl
ntohs
recv
send
connect
htons
socket
closesocket
gethostbyname
WSAStartup
WSACleanup
inet_addr
recvfrom
sendto
ioctlsocket
gethostname
bind
freeaddrinfo

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

iphlpapi

GetAdaptersInfo

wldap32

ord211
ord46
ord143
ord60
ord50
ord41
ord22
ord26
ord27
ord32
ord301
ord200
ord30
ord79
ord35
ord33

crypt32

CertFreeCertificateContext

httpapi

HttpCreateHttpHandle
HttpReceiveHttpRequest
HttpInitialize
HttpReceiveRequestEntityBody
HttpSendHttpResponse
HttpRemoveUrl
HttpTerminate
HttpAddUrl

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 416KB - Virtual size: 415KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 347KB - Virtual size: 346KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
aapt.exe
.exe windows:4 windows x86 arch:x86

6cae795410282b03a8c84b120ba75b69

Code Sign

13:8e:17:6f:58:c0:ad:eb:52:37:57:e5:f6:38:57:1a
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

15/06/2016, 02:19

Not After

15/09/2019, 02:19

Subject

CN=北京蓝叠科技有限公司,O=北京蓝叠科技有限公司,L=北京市,ST=北京市,C=CN,1.2.840.113549.1.9.1=#0c12616d7940626c7565737461636b732e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3a:de:c4:02:27:0b:f4:ee:9e:89:2c:c6:5e:0a:da:21
Certificate

Issuer

CN=CA 沃通根证书,O=WoSign CA Limited,C=CN

Not Before

10/07/2015, 00:58

Not After

10/07/2025, 00:58

Subject

CN=CA 沃通 EV 代码签名证书,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:03:26:71:e6:33:9f:cc:9f:4b:51:df:ea:05:0c:6d
Certificate

Issuer

CN=CA 沃通 EV 代码签名证书,O=WoSign CA Limited,C=CN

Not Before

15/06/2016, 02:16

Not After

15/09/2019, 02:16

Subject

SERIALNUMBER=110000450266341,CN=北京蓝叠科技有限公司,O=北京蓝叠科技有限公司,POSTALCODE=100191,STREET=北京市海淀区花园路2号牡丹创业楼2204室,L=北京市,ST=北京市,C=CN,1.2.840.113549.1.9.1=#0c12616d7940626c7565737461636b732e636f6d,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:90:2c:86:5f:c6:4f:1b:75:28:ce:83:d6:08:fc:a0:34:92:5b:a0:4a:a7:0d:80:78:b8:99:34:9c:ba:88:4a
Signer

Actual PE Digest

44:90:2c:86:5f:c6:4f:1b:75:28:ce:83:d6:08:fc:a0:34:92:5b:a0:4a:a7:0d:80:78:b8:99:34:9c:ba:88:4a

Digest Algorithm

sha256

PE Digest Matches

true

7d:d2:54:7d:b9:b3:28:5c:66:3e:98:71:2a:7f:dc:4e:e2:98:10:8b
Signer

Actual PE Digest

7d:d2:54:7d:b9:b3:28:5c:66:3e:98:71:2a:7f:dc:4e:e2:98:10:8b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
CreateEventA
CreateFileMappingA
CreateMutexA
CreateSemaphoreA
CreateThread
DeleteCriticalSection
EnterCriticalSection
ExitProcess
GetCurrentThreadId
GetFileAttributesA
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemInfo
GetSystemTimeAsFileTime
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsDBCSLeadByteEx
LeaveCriticalSection
MapViewOfFile
MultiByteToWideChar
ReleaseMutex
ReleaseSemaphore
SetLastError
SetUnhandledExceptionFilter
SignalObjectAndWait
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnmapViewOfFile
WaitForSingleObject
WideCharToMultiByte

msvcrt

_access
_close
_dup
_fdopen
_fstat
_getpid
_lseek
_open
_read
_stat
_strdup
_unlink
_write
__getmainargs
__lc_codepage
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_cexit
_chsize
_errno
_filbuf
_findclose
_findfirst
_findnext
_fullpath
_get_osfhandle
_iob
_isctype
_lseeki64
_mkdir
_onexit
_pctype
_setjmp
_setmode
_stricmp
_strnicmp
abort
atexit
atoi
calloc
exit
fclose
fflush
fopen
fprintf
fputc
fputs
fread
free
fseek
ftell
fwrite
getenv
gmtime
localeconv
localtime
longjmp
malloc
memchr
memcpy
memmove
memset
mktime
pow
printf
putchar
puts
qsort
rand
realloc
remove
rewind
signal
sprintf
srand
strcat
strchr
strcmp
strcpy
strerror
strftime
strlen
strncmp
strncpy
strrchr
strstr
strtok
strtol
time
tolower
toupper
wcslen

Sections

.text
Size: 682KB - Virtual size: 681KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 126KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ckeymapui.exe
.exe windows:5 windows x86 arch:x86

8e5719003f612ac646d9e5b0513d9ad6

Code Sign

13:8e:17:6f:58:c0:ad:eb:52:37:57:e5:f6:38:57:1a
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

15/06/2016, 02:19

Not After

15/09/2019, 02:19

Subject

CN=北京蓝叠科技有限公司,O=北京蓝叠科技有限公司,L=北京市,ST=北京市,C=CN,1.2.840.113549.1.9.1=#0c12616d7940626c7565737461636b732e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3a:de:c4:02:27:0b:f4:ee:9e:89:2c:c6:5e:0a:da:21
Certificate

Issuer

CN=CA 沃通根证书,O=WoSign CA Limited,C=CN

Not Before

10/07/2015, 00:58

Not After

10/07/2025, 00:58

Subject

CN=CA 沃通 EV 代码签名证书,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:03:26:71:e6:33:9f:cc:9f:4b:51:df:ea:05:0c:6d
Certificate

Issuer

CN=CA 沃通 EV 代码签名证书,O=WoSign CA Limited,C=CN

Not Before

15/06/2016, 02:16

Not After

15/09/2019, 02:16

Subject

SERIALNUMBER=110000450266341,CN=北京蓝叠科技有限公司,O=北京蓝叠科技有限公司,POSTALCODE=100191,STREET=北京市海淀区花园路2号牡丹创业楼2204室,L=北京市,ST=北京市,C=CN,1.2.840.113549.1.9.1=#0c12616d7940626c7565737461636b732e636f6d,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9c:64:05:20:ba:0d:ea:2b:77:13:85:a4:cf:0f:bb:f3:5e:e1:ed:3e:24:56:37:50:b4:bc:c7:51:4f:13:48:bd
Signer

Actual PE Digest

9c:64:05:20:ba:0d:ea:2b:77:13:85:a4:cf:0f:bb:f3:5e:e1:ed:3e:24:56:37:50:b4:bc:c7:51:4f:13:48:bd

Digest Algorithm

sha256

PE Digest Matches

true

eb:38:de:e8:29:5f:3d:87:76:b8:00:a1:36:f3:45:c6:f1:14:ef:68
Signer

Actual PE Digest

eb:38:de:e8:29:5f:3d:87:76:b8:00:a1:36:f3:45:c6:f1:14:ef:68

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\bschina\bin\ckeymapui.pdb

Imports

kernel32

PeekNamedPipe
ReadFile
GetStdHandle
GetFileType
WaitForMultipleObjects
VerifyVersionInfoA
GetSystemDirectoryA
VerSetConditionMask
SleepEx
FormatMessageA
GetModuleHandleA
LoadLibraryA
GetVersionExA
MulDiv
GetFullPathNameW
FindResourceW
SizeofResource
LoadResource
LockResource
FreeResource
HeapDestroy
SetEndOfFile
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetCurrentDirectoryW
SetStdHandle
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
FlushFileBuffers
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetACP
ExitProcess
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
HeapCreate
SetFilePointerEx
GetModuleHandleExW
ExitThread
RtlUnwind
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
DuplicateHandle
VirtualProtect
VirtualFree
VirtualAlloc
FreeLibraryAndExitThread
GetThreadTimes
GetCurrentThread
OutputDebugStringW
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SwitchToThread
SignalObjectAndWait
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
SetEvent
FlushInstructionCache
LoadLibraryExW
GlobalAlloc
MultiByteToWideChar
WideCharToMultiByte
GetTickCount
InterlockedIncrement
CopyFileW
FreeLibrary
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
GetProcAddress
HeapAlloc
LoadLibraryW
CloseHandle
DeleteFileW
GetLastError
Sleep
OpenProcess
GetVersionExW
CreateFileW
WaitForSingleObject
FindClose
GetTempPathW
InitializeCriticalSection
LeaveCriticalSection
GetModuleFileNameW
TerminateProcess
InterlockedDecrement
WriteFile
GetCurrentProcess
HeapSize
HeapReAlloc
RaiseException
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
DecodePointer
EncodePointer
GetStringTypeW
TryEnterCriticalSection
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
CreateDirectoryA
GetModuleHandleExA
GetModuleFileNameA
CreateSemaphoreW
GetSystemTimeAsFileTime
ReleaseSemaphore
GetCurrentThreadId
GlobalUnlock
GlobalLock
LocalFree
FindNextFileW
GetCommandLineW
EnterCriticalSection
SetLastError
HeapFree
FindFirstFileW
GetDriveTypeW

user32

GetSystemMetrics
CopyRect
GetMonitorInfoW
SendMessageW
MonitorFromWindow
SetCursor
GetCursorPos
PtInRect
PostQuitMessage
BringWindowToTop
MoveWindow
IsWindow
GetKeyState
SetWindowPos
GetWindowRect
PostMessageW
GetWindowLongW
GetWindowTextW
ReleaseDC
GetAncestor
GetParent
EnableMenuItem
GetClientRect
GetClassNameW
EnumWindows
ClientToScreen
EnumChildWindows
GetDC
GetWindowThreadProcessId
DrawIconEx
InvertRect
FillRect
SetRect
ShowWindow
GetActiveWindow
ScreenToClient
IsWindowVisible
IntersectRect
MapVirtualKeyA
OffsetRect
LoadCursorW
DestroyCursor
DestroyWindow
SetTimer
KillTimer
InflateRect
UnionRect
IsRectEmpty
EqualRect
CharNextW
DestroyIcon
GetIconInfo
GetSysColor
DefWindowProcW
CallWindowProcW
UnregisterClassW
RegisterClassExW
CreateWindowExW
GetDlgItem
SetWindowLongW
SetFocus
GetFocus
EnableWindow
IsWindowEnabled
SetActiveWindow
GetDesktopWindow
TrackMouseEvent
AnimateWindow
SetLayeredWindowAttributes
IsIconic
IsZoomed
GetCapture
SetCapture
ReleaseCapture
UpdateWindow
BeginPaint
EndPaint
InvalidateRect
SetWindowTextW
CreateCaret
GetCaretBlinkTime
HideCaret
SetCaretPos
MapWindowPoints
GetWindow
LoadBitmapW
CreateIconFromResource
LoadImageW
CharLowerBuffW
GetMessageW
TranslateMessage
DispatchMessageW
UpdateLayeredWindow
SetForegroundWindow
GetMenuItemInfoW
TrackPopupMenu
AppendMenuW
GetMenuItemCount
DestroyMenu
CreatePopupMenu
SystemParametersInfoA
DrawTextW
PeekMessageW

gdi32

SetWorldTransform
CreateDIBSection
Polyline
CreateSolidBrush
GetCurrentObject
SetViewportOrgEx
CreateRoundRectRgn
CreateBitmap
SetBkMode
Rectangle
GetClipBox
GetWorldTransform
CreateFontIndirectW
SetGraphicsMode
GetStockObject
EnumFontsW
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
StretchBlt
GetDeviceCaps
DeleteDC
DeleteObject
GetObjectW
GetViewportOrgEx
Arc
Chord
CombineRgn
CreatePen
CreatePatternBrush
CreateRectRgn
CreateRectRgnIndirect
Ellipse
ExcludeClipRect
GetClipRgn
GetRgnBox
GetTextColor
GetTextExtentPoint32W
IntersectClipRect
OffsetRgn
PtInRegion
RectInRegion
RestoreDC
RoundRect
SaveDC
ExtSelectClipRgn
SetRectRgn
SetTextColor

advapi32

RegQueryValueExW
RegOpenKeyExW
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegQueryInfoKeyW
RegEnumKeyExW
RegCloseKey

shell32

ShellExecuteW

ole32

CreateBindCtx
OleLockRunning
CreateStreamOnHGlobal
IIDFromString
CLSIDFromProgID
CLSIDFromString
OleInitialize
OleUninitialize
CoCreateInstance

oleaut32

GetErrorInfo
SysFreeString
SysAllocString

shlwapi

PathAppendW
StrToIntExW
PathFileExistsW
PathIsDirectoryA
StrToIntW

winhttp

WinHttpQueryDataAvailable
WinHttpOpen
WinHttpReceiveResponse
WinHttpCrackUrl
WinHttpReadData
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpSendRequest
WinHttpConnect

ws2_32

WSAGetLastError
WSACleanup
__WSAFDIsSet
getsockname
ntohl
select
htonl
gethostname
ioctlsocket
sendto
recvfrom
listen
accept
freeaddrinfo
getaddrinfo
WSAIoctl
getpeername
send
socket
setsockopt
ntohs
htons
getsockopt
recv
WSAStartup
connect
closesocket
bind
WSASetLastError

wldap32

ord50
ord60
ord46
ord211
ord41
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord143

crypt32

CertFreeCertificateContext

winmm

joyGetPos
joyGetNumDevs
joyGetDevCapsW
joyGetPosEx

psapi

EnumProcessModules
GetModuleFileNameExW

imm32

ImmReleaseContext
ImmGetContext
ImmAssociateContext

gdiplus

GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipGraphicsClear
GdipDrawImageRectI
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromStream

msimg32

AlphaBlend
GradientFill

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 262KB - Virtual size: 262KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
uires/Translator/lang_cn.xml
uires/Translator/lang_en.xml
uires/Translator/lang_tn.xml
uires/amap/Location.html
.js
uires/amap/img/down_arrow.png
.png
uires/amap/img/input_border.png
.png
uires/amap/img/jquery-3.1.1.min.js
.js
uires/amap/img/location_close.png
.png
uires/amap/img/location_search.png
.png
uires/amap/img/location_tab.png
.png
uires/amap/img/mark_click.png
.png
uires/amap/img/mark_number.png
.png
uires/amap/img/search_close.png
.png
uires/amap/js/amap.js
.js
uires/amap/js/gmap.js
.js
uires/bctv/DouyuConnectFailedWindow.xml
uires/bctv/SendMsgFailedWindow.xml
uires/bctv/bctv.html
.js
uires/bctv/dlg_bctv.xml
uires/bctv/dlg_web_new_window.xml
uires/bctv/fishSignIn.html
.js
uires/bctv/js/bctv.js
.js
uires/bctv/js/bytebuffer.js
.js
uires/bctv/js/bytebuffer.min.js
.js
uires/bctv/js/fish.js
.js
uires/bctv/js/jquery-1.11.3.min.js
.js
uires/bctv/js/json2.js
.js
uires/bctv/js/long.js
.js
uires/bctv/js/long.min.js
.js
uires/bctv/js/md5.js
uires/bctv/js/md5.min.js
.js
uires/bctv/js/panda-jssdk.js
.js
uires/bctv/js/panda.js
.js
uires/bctv/page_endlive.xml
uires/bctv/page_guidance.xml
uires/bctv/page_login_douyu.xml
uires/bctv/page_onlive.xml
uires/bctv/page_selectinup.xml
uires/bctv/page_setting.xml
uires/bctv/test.html
.js
uires/guide/guide_enter.png
.png
uires/guide/guide_frame.png
.png
uires/guide/guide_next.png
.png
uires/guide/guide_prev.png
.png
uires/guide/guide_skip.png
.png
uires/image/BlueStacks.ico
uires/image/BlueStacks.png
.png
uires/image/LD_bg.png
.png
uires/image/about_sep.png
.png
uires/image/addapk.png
.png
uires/image/ani_arrow_notice.png
.png
uires/image/app_delete.png
.png
uires/image/app_frame.png
.png
uires/image/appmask.png
.png
uires/image/appmenu.png
.png
uires/image/arrow.png
.png
uires/image/bar_shop_drop.png
.png
uires/image/bar_shop_tab.png
.png
uires/image/btn_app.png
.png
uires/image/btn_close.png
.png
uires/image/btn_dlg_close.png
.png
uires/image/btn_exit_no.png
.png
uires/image/btn_exit_select.png
.png
uires/image/btn_exit_yes.png
.png
uires/image/btn_save.png
.png
uires/image/btn_search_install.png
.png
uires/image/btv/JT_s.png
.png
uires/image/btv/JT_x.png
.png
uires/image/btv/btn_camera.png
.png
uires/image/btv/btn_disable_camera.png
.png
uires/image/btv/btn_disable_mic.png
.png
uires/image/btv/btn_golive.png
.png
uires/image/btv/btn_mic.png
.png
uires/image/btv/btn_send.png
.png
uires/image/btv/btn_setting_golive.png
.png
uires/image/btv/btn_setting_golive_icon.png
.png
uires/image/btv/btn_share.png
.png
uires/image/btv/btn_stop.png
.png
uires/image/btv/btv_login_bk.jpg
.jpg
uires/image/btv/btv_logo.png
.png
uires/image/btv/btv_window_bk.jpg
.jpg
uires/image/btv/chect_online_bk.png
.png
uires/image/btv/close.png
.png
uires/image/btv/detail_bg.png
.png
uires/image/btv/douyu_login_icon.png
.png
uires/image/btv/douyu_onlive_icon.png
.png
uires/image/btv/douyu_onlive_icon_disable.png
.png
uires/image/btv/end_prompt_bk.png
.png
uires/image/btv/longer_streaming_bk.png
.png
uires/image/btv/minimize.png
.png
uires/image/btv/online_icon.png
.png
uires/image/btv/panda_login_icon.png
.png
uires/image/btv/panda_onlive_icon.png
.png
uires/image/btv/panda_onlive_icon_disable.png
.png
uires/image/btv/play.png
.png
uires/image/btv/sign_icon.png
.png
uires/image/btv/sign_in_bk.png
.png
uires/image/btv/sign_up_bk.png
.png
uires/image/btv/snail.png
.png
uires/image/btv/stream-title.png
.png
uires/image/btv/username_icon.png
.png
uires/image/btv/version
uires/image/btv/头像框.png
.png
uires/image/btv/导航bg.png
.png
uires/image/btv/添加.png
.png
uires/image/caption_shadow.png
.png
uires/image/cfgmenu.png
.png
uires/image/channels/18183_title_logo.png
.png
uires/image/check_loading_info.png
.png
uires/image/checkbox.png
.png
uires/image/close.png
.png
uires/image/close2.png
.png
uires/image/colorbtn.png
.png
uires/image/compass_icon.png
.png
uires/image/decrease.png
.png
uires/image/detail_close.png
.png
uires/image/edit_bg.png
.png
uires/image/error.png
.png
uires/image/exitscr.png
.png
uires/image/fancybg.jpg
.jpg
uires/image/fancybg_shadow.png
.png
uires/image/fb_add_apk.png
.png
uires/image/fb_delete_app.png
.png
uires/image/fb_multi_inst.png
.png
uires/image/forward.png
.png
uires/image/fullscr.png
.png
uires/image/function_bar.png
.png
uires/image/goback.png
.png
uires/image/gohome.png
.png
uires/image/growingbg.png
.png
uires/image/ico_browser.png
.png
uires/image/ico_browser_28.png
.png
uires/image/ico_camera.png
.png
uires/image/ico_camera_28.png
.png
uires/image/ico_fakegps.png
.png
uires/image/ico_fakegps_28.png
.png
uires/image/ico_filemgr.png
.png
uires/image/ico_filemgr_28.png
.png
uires/image/ico_googlemarket.png
.png
uires/image/ico_setting.png
.png
uires/image/ico_setting_28.png
.png
uires/image/ico_sysfolder.png
.png
uires/image/icon_facebook.png
.jpg
uires/image/icon_googlegame.png
.png
uires/image/img_busy.png
.png
uires/image/img_busy2.png
.png
uires/image/increase.png
.png
uires/image/inst_bg2.png
.png
uires/image/inst_pro_bar.png
.png
uires/image/inst_pro_bg.png
.png
uires/image/install_ani.png
.png
uires/image/item_bk.png
.png
uires/image/kdbs_logo.png
.png
uires/image/keymap.png
.png
uires/image/keymap_bg.png
.png
uires/image/locate.png
.png
uires/image/location_tab.png
.png
uires/image/login/account_close.png
.png
uires/image/login/loggedin.png
.png
uires/image/login/unloggedin.png
.png
uires/image/login/usernamebg.png
.png
uires/image/logo24.png
.png
uires/image/logo_title.png
.png
uires/image/mark.png
.png
uires/image/maximize.png
.png
uires/image/menu_arrow.png
.png
uires/image/menu_bg.png
.png
uires/image/menu_check.png
.png
uires/image/menu_sep.png
.png
uires/image/menu_skin.png
.png
uires/image/minimize.png
.png
uires/image/more_tab.png
.png
uires/image/more_tab2.png
.png
uires/image/more_tool.png
.png
uires/image/msg_excl.ico
uires/image/msg_info.ico
uires/image/msg_ques.ico
uires/image/msgboxbg.png
.png
uires/image/plus.png
.png
uires/image/progress.png
.png
uires/image/progress2_bg.png
.png
uires/image/progress2_br.png
.png
uires/image/progress_bk.png
.png
uires/image/prompt_bg.png
.png
uires/image/quitsysfolder.png
.png
uires/image/ratio_edit_bg.png
.png
uires/image/ratio_radio.png
.png
uires/image/refresh.png
.png
uires/image/restore.png
.png
uires/image/retry.png
.png
uires/image/return.png
.png
uires/image/scroll.png
.png
uires/image/scrshot.png
.png
uires/image/search_btn.png
.png
uires/image/search_frame.png
.png
uires/image/select_bg_like.png
.png
uires/image/select_bg_like_deep.png
.png
uires/image/shake.png
.png
uires/image/special/multi_xp_popup.png
.png
uires/image/switch.png
.png
uires/image/switch2.png
.png
uires/image/tab_main.png
.png
uires/image/tabbtn.png
.png
uires/image/tabbtn2.png
.png
uires/image/tabbtn_del.png
.png
uires/image/unknownapp.png
.png
uires/image/update_hide.png
.png
uires/image/volume_switch.png
.png
uires/image/xycm_logo.png
.png
uires/newyear/dlg_show_url.xml
uires/newyear/firecracker1.png
.png
uires/newyear/firecracker2.png
.png
uires/newyear/firecracker_line.png
.png
uires/newyear/fold.png
.png
uires/newyear/img_explode.png
.png
uires/newyear/lanterns.png
.png
uires/newyear/unfold.png
.png
uires/newyear/web_close.png
.png
uires/uidef/init.xml
uires/uires.idx
uires/values/color.xml
.xml
uires/values/skin.xml
.xml
uires/values/string.xml
.xml
uires/xml/cfgmenu.xml
uires/xml/dlg_about_kdbs.xml
uires/xml/dlg_about_xycm.xml
uires/xml/dlg_appdetails.xml
uires/xml/dlg_bosskey.xml
uires/xml/dlg_bosskey_vert.xml
uires/xml/dlg_bsapppop.xml
uires/xml/dlg_closeoption.xml
uires/xml/dlg_closeoption_vert.xml
uires/xml/dlg_compatibility.xml
uires/xml/dlg_enginesetting.xml
uires/xml/dlg_exit.xml
uires/xml/dlg_fullctrl.xml
uires/xml/dlg_generaldl.xml
uires/xml/dlg_guide.xml
uires/xml/dlg_keymap_prompt.xml
uires/xml/dlg_main.xml
uires/xml/dlg_multi_xp_popup.xml
uires/xml/dlg_new_url_window.xml
uires/xml/dlg_popup1.xml
uires/xml/dlg_prompt_pokemongo.xml
uires/xml/dlg_ratio.xml
uires/xml/dlg_search_prompt.xml
uires/xml/dlg_update.xml
uires/xml/dlg_useraccount.xml
uires/xml/dlg_usercenter.xml
uires/xml/dlg_waiting.xml
uires/xml/menu_app.xml
uires/xml/menu_loggedin.xml
uires/xml/menu_more_tool.xml
uires/xml/menu_multi_inst.xml
uires/xml/msgbox.xml
wke.dll
.dll windows:5 windows x86 arch:x86

ff33ef901571125cafe67a70079e67ba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\projects\wke-code\build\vs2008\Release_Cairo_CFLite\bin\wke.pdb

Imports

kernel32

LockFile
AreFileApisANSI
LockFileEx
UnlockFile
GetFileAttributesW
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetVersion
GlobalMemoryStatus
FlushConsoleInputBuffer
ReadConsoleInputA
SetConsoleMode
GetCurrentDirectoryW
TlsSetValue
GetTickCount
TlsGetValue
TlsAlloc
InterlockedIncrement
OutputDebugStringW
IsValidCodePage
GetACP
WideCharToMultiByte
MultiByteToWideChar
GetProcessHeap
SetEndOfFile
CompareStringW
CompareStringA
GetStringTypeW
GetStringTypeA
LCMapStringA
GetConsoleOutputCP
WriteConsoleA
GetFullPathNameA
GetFullPathNameW
InitializeCriticalSectionAndSpinCount
HeapDestroy
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
SetEvent
CloseHandle
WaitForSingleObject
CreateEventA
InterlockedExchange
GetProcessAffinityMask
GetCurrentProcess
LeaveCriticalSection
EnterCriticalSection
GetLastError
GetCurrentProcessId
Sleep
SetLastError
GetThreadPriority
DuplicateHandle
GetCurrentThread
GetCurrentThreadId
ReleaseSemaphore
InterlockedDecrement
TlsFree
DeleteCriticalSection
GetProcAddress
FreeLibrary
InitializeCriticalSection
ResetEvent
SetThreadContext
GetThreadContext
ResumeThread
SuspendThread
WaitForMultipleObjects
LoadLibraryA
GetThreadTimes
QueryPerformanceCounter
QueryPerformanceFrequency
LoadLibraryW
GetSystemDirectoryW
ReadFile
GetFileSize
CreateFileW
WriteFile
DeleteFileW
RemoveDirectoryW
CreateFileA
GetTempPathA
GetTempPathW
GetVersionExW
GetModuleHandleA
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
GetLocaleInfoW
GetUserDefaultUILanguage
VirtualProtect
GetFileAttributesExW
LoadLibraryExW
SetCurrentDirectoryW
ExpandEnvironmentStringsW
GetModuleFileNameW
FindClose
FindNextFileW
FindFirstFileW
GlobalAlloc
lstrlenW
RegisterWaitForSingleObject
CreateEventW
CreateTimerQueueTimer
DeleteTimerQueueTimer
CreateTimerQueue
GetPrivateProfileStringW
InterlockedCompareExchange
GetLocaleInfoA
GetUserDefaultLangID
GetCurrentDirectoryA
GetModuleFileNameA
GetModuleHandleW
GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetSystemTimeAsFileTime
MapViewOfFileEx
CreateFileMappingA
OpenFileMappingA
CreateDirectoryA
RemoveDirectoryA
DeleteFileA
FlushFileBuffers
FindNextFileA
FindFirstFileA
GetSystemTime
IsDebuggerPresent
RaiseException
TryEnterCriticalSection
ReleaseMutex
CreateMutexW
CreateSemaphoreW
VirtualAlloc
VirtualFree
GetSystemInfo
VirtualQuery
LocalFree
FormatMessageW
GetVersionExA
FormatMessageA
SleepEx
PeekNamedPipe
GetFileType
GetStdHandle
ExpandEnvironmentStringsA
GetSystemDirectoryA
GetCommandLineA
HeapFree
HeapAlloc
ExitThread
CreateThread
RtlUnwind
ExitProcess
GetTimeFormatA
GetDateFormatA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FileTimeToLocalFileTime
GetDriveTypeW
HeapSize
HeapReAlloc
GetDriveTypeA
SetFilePointer
GetConsoleCP
GetConsoleMode
GetFileInformationByHandle
SetStdHandle
SetFileAttributesA
GetFileAttributesA
WriteConsoleW
GetCPInfo
GetOEMCP
LCMapStringW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetConsoleCtrlHandler

user32

SystemParametersInfoA
MsgWaitForMultipleObjects
UnhookWindowsHookEx
SetTimer
GetQueueStatus
RegisterWindowMessageW
PostMessageW
KillTimer
GetIconInfo
GetLastInputInfo
EnumDisplaySettingsW
MonitorFromWindow
GetMonitorInfoW
SendMessageW
DefWindowProcA
SetWindowLongA
SetPropW
SetCapture
ReleaseCapture
CallWindowProcW
DestroyWindow
InvalidateRect
SetWindowRgn
MoveWindow
UpdateWindow
GetMessageTime
IsChild
SetFocus
ShowWindow
RegisterClassExW
GetPropW
GetClientRect
MessageBeep
GetClipboardData
SetClipboardData
IsClipboardFormatAvailable
OpenClipboard
EmptyClipboard
CloseClipboard
RegisterClassW
CreateWindowExW
RegisterClipboardFormatW
DefWindowProcW
NotifyWinEvent
GetMessageW
GetWindowLongW
SetWindowLongW
DrawIconEx
GetDC
CreateIconIndirect
ReleaseDC
LoadCursorW
DestroyIcon
DrawEdge
GetSystemMetrics
FrameRect
InflateRect
DrawFrameControl
FillRect
GetSysColor
GetKeyState
MessageBoxA
PtInRect
FindWindowW
DispatchMessageW
TranslateMessage
SetCursor
CharNextExA
SystemParametersInfoW
GetDoubleClickTime
PeekMessageW
DrawTextW
GetUserObjectInformationW
GetProcessWindowStation
GetFocus
GetSysColorBrush
GetDesktopWindow

gdi32

SetBkMode
CreateCompatibleBitmap
SaveDC
RestoreDC
ModifyWorldTransform
SetWorldTransform
IntersectClipRect
GetWorldTransform
GetRgnBox
BitBlt
CreateDIBSection
SetTextColor
SelectObject
GetStockObject
CreateCompatibleDC
GetCharWidthI
GetGlyphOutlineW
GetOutlineTextMetricsW
GetTextMetricsW
CreateFontIndirectW
GetTextFaceW
EnumFontFamiliesExW
GetFontUnicodeRanges
DeleteEnhMetaFile
DeleteDC
SetGraphicsMode
GetCurrentObject
GetObjectW
CreateBitmap
CreatePatternBrush
SetBkColor
GetViewportOrgEx
SetBrushOrgEx
CreateRectRgn
DeleteObject
CreateSolidBrush
StretchDIBits
GetDeviceCaps
GetCharWidth32A
GetTextMetricsA
GetFontData
SetMapMode
GetOutlineTextMetricsA
SetTextAlign
ExtTextOutW
SelectClipRgn
ExtCreateRegion
ExtSelectClipRgn
GetGraphicsMode
GetClipBox
GetClipRgn
GdiFlush
GetGlyphIndicesW
CreateEnhMetaFileW
CloseEnhMetaFile
EnumEnhMetaFile

ole32

CoInitialize
OleDuplicateData
ReleaseStgMedium
OleGetClipboard
CoUninitialize
CoCreateInstance

iphlpapi

GetAdaptersAddresses
NotifyAddrChange

winmm

timeBeginPeriod
timeEndPeriod

ws2_32

select
gethostname
__WSAFDIsSet
getsockname
getpeername
WSAGetLastError
closesocket
WSASetLastError
ntohs
inet_addr
gethostbyname
inet_ntoa
getservbyname
gethostbyaddr
getservbyport
ioctlsocket
bind
htonl
socket
WSACleanup
WSAStartup
send
sendto
setsockopt
listen
getsockopt
htons
accept
recvfrom
recv
connect
shutdown

advapi32

CryptReleaseContext
CryptAcquireContextW
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
RegOpenKeyExW
CryptGenRandom
DeregisterEventSource
ReportEventA
RegisterEventSourceA

shell32

ExtractIconExW
SHGetFileInfoW
DragQueryFileW
DragFinish
SHCreateDirectoryExW

usp10

ScriptPlace
ScriptItemize
ScriptXtoCP
ScriptFreeCache
ScriptStringFree
ScriptShape
ScriptStringAnalyse
ScriptStringOut

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

shlwapi

PathRemoveFileSpecW
PathGetCharTypeW
PathRenameExtensionW
PathFindFileNameW
PathAppendW
PathCombineA
SHGetValueW
PathCombineW
PathIsUNCW
PathFileExistsA
PathIsUNCA
PathFindExtensionW
PathRemoveExtensionW
PathFileExistsW

Exports

Exports

jsArg
jsArgCount
jsArgType
jsArray
jsBindFunction
jsBindGetter
jsBindSetter
jsBoolean
jsCall
jsCallGlobal
jsDouble
jsEval
jsEvalW
jsFalse
jsFloat
jsFunction
jsGC
jsGet
jsGetAt
jsGetGlobal
jsGetLength
jsGetWebView
jsGlobalObject
jsInt
jsIsArray
jsIsBoolean
jsIsFalse
jsIsFunction
jsIsNull
jsIsNumber
jsIsObject
jsIsString
jsIsTrue
jsIsUndefined
jsNull
jsObject
jsSet
jsSetAt
jsSetGlobal
jsSetLength
jsString
jsStringW
jsToBoolean
jsToDouble
jsToFloat
jsToInt
jsToString
jsToStringW
jsTrue
jsTypeOf
jsUndefined
wkeAddDirtyArea
wkeAwaken
wkeCanGoBack
wkeCanGoForward
wkeContentsHeight
wkeContentsWidth
wkeContextMenuEvent
wkeCookieEnabled
wkeCopy
wkeCreateWebView
wkeCut
wkeDelete
wkeDestroyWebView
wkeFocus
wkeGetCaret
wkeGetClientHandler
wkeGetWebView
wkeGlobalExec
wkeGoBack
wkeGoForward
wkeHeight
wkeInit
wkeIsAwake
wkeIsDirty
wkeIsDocumentReady
wkeIsLoadComplete
wkeIsLoadFailed
wkeIsLoaded
wkeIsTransparent
wkeKeyDown
wkeKeyPress
wkeKeyUp
wkeLayoutIfNeeded
wkeLoadFile
wkeLoadFileW
wkeLoadHTML
wkeLoadHTMLW
wkeLoadURL
wkeLoadURLW
wkeMediaVolume
wkeMouseEvent
wkeMouseWheel
wkePaint
wkePaste
wkeRefreshPlugins
wkeReload
wkeResize
wkeRunJS
wkeRunJSW
wkeSelectAll
wkeSetClientHandler
wkeSetCookieEnabled
wkeSetDirty
wkeSetEditable
wkeSetFileSystem
wkeSetMediaVolume
wkeSetTransparent
wkeSetWebViewName
wkeSetZoomFactor
wkeShutdown
wkeSleep
wkeStopLoading
wkeTitle
wkeTitleW
wkeToString
wkeToStringW
wkeUnfocus
wkeUpdate
wkeVersion
wkeVersionString
wkeWebViewName
wkeWidth
wkeZoomFactor

Sections

.text
Size: 8.8MB - Virtual size: 8.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 137KB - Virtual size: 794KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.unwante
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 548KB - Virtual size: 548KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

32f3282581436269b3a75b6675fe3e08

Code Sign

13:8e:17:6f:58:c0:ad:eb:52:37:57:e5:f6:38:57:1aCertificate

Extended Key Usages

Key Usages

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate

Extended Key Usages

Key Usages

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91Certificate

Key Usages

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79Certificate

Extended Key Usages

Key Usages

3a:de:c4:02:27:0b:f4:ee:9e:89:2c:c6:5e:0a:da:21Certificate

Extended Key Usages

Key Usages

11:03:26:71:e6:33:9f:cc:9f:4b:51:df:ea:05:0c:6dCertificate

Extended Key Usages

Key Usages

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate

Extended Key Usages

Key Usages

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91Certificate

Key Usages

6a:8d:17:2f:fa:f6:4a:d6:ec:13:1d:05:b7:a8:95:bc:62:e5:e3:82:50:a7:a1:6f:ab:b7:ef:ea:39:f6:46:a1Signer

71:ae:e0:44:be:36:dd:22:b6:46:e7:e7:08:58:35:7a:bc:74:cc:55Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 415KB

.ndata Size: - Virtual size: 708KB

.rsrc Size: 350KB - Virtual size: 350KB

.reloc Size: 4KB - Virtual size: 3KB

4e8bba296511756970778b3728d39385

Code Sign

13:8e:17:6f:58:c0:ad:eb:52:37:57:e5:f6:38:57:1aCertificate

Extended Key Usages

Key Usages

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate

Extended Key Usages

Key Usages

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91Certificate

Key Usages

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79Certificate

Extended Key Usages

Key Usages

3a:de:c4:02:27:0b:f4:ee:9e:89:2c:c6:5e:0a:da:21Certificate

Extended Key Usages

Key Usages

11:03:26:71:e6:33:9f:cc:9f:4b:51:df:ea:05:0c:6dCertificate

Extended Key Usages

Key Usages

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate

Extended Key Usages

Key Usages

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91Certificate

Key Usages

98:c9:05:b7:8c:7b:9d:bf:05:f7:90:ed:56:17:70:fe:97:01:71:7a:e5:33:cf:cd:eb:3b:51:64:a5:e5:e9:e8Signer

99:26:fd:bf:82:23:6c:ba:7c:d1:21:49:cc:56:58:ac:79:ba:d7:ddSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

13:8e:17:6f:58:c0:ad:eb:52:37:57:e5:f6:38:57:1a
Certificate

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

3a:de:c4:02:27:0b:f4:ee:9e:89:2c:c6:5e:0a:da:21
Certificate

11:03:26:71:e6:33:9f:cc:9f:4b:51:df:ea:05:0c:6d
Certificate

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

6a:8d:17:2f:fa:f6:4a:d6:ec:13:1d:05:b7:a8:95:bc:62:e5:e3:82:50:a7:a1:6f:ab:b7:ef:ea:39:f6:46:a1
Signer

71:ae:e0:44:be:36:dd:22:b6:46:e7:e7:08:58:35:7a:bc:74:cc:55
Signer

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 415KB

.ndata
Size: - Virtual size: 708KB

.rsrc
Size: 350KB - Virtual size: 350KB

.reloc
Size: 4KB - Virtual size: 3KB

13:8e:17:6f:58:c0:ad:eb:52:37:57:e5:f6:38:57:1a
Certificate

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

3a:de:c4:02:27:0b:f4:ee:9e:89:2c:c6:5e:0a:da:21
Certificate

11:03:26:71:e6:33:9f:cc:9f:4b:51:df:ea:05:0c:6d
Certificate

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

98:c9:05:b7:8c:7b:9d:bf:05:f7:90:ed:56:17:70:fe:97:01:71:7a:e5:33:cf:cd:eb:3b:51:64:a5:e5:e9:e8
Signer

99:26:fd:bf:82:23:6c:ba:7c:d1:21:49:cc:56:58:ac:79:ba:d7:dd
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 252KB - Virtual size: 252KB

.data
Size: 16KB - Virtual size: 85KB

.gfids
Size: 3KB - Virtual size: 3KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 67KB - Virtual size: 66KB

13:8e:17:6f:58:c0:ad:eb:52:37:57:e5:f6:38:57:1a
Certificate

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

3a:de:c4:02:27:0b:f4:ee:9e:89:2c:c6:5e:0a:da:21
Certificate

11:03:26:71:e6:33:9f:cc:9f:4b:51:df:ea:05:0c:6d
Certificate

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

19:c5:e6:d7:57:50:3c:49:fb:d1:05:40:b7:4f:0d:c5:02:32:87:99:18:53:0d:75:92:c7:24:56:e1:ce:9d:31
Signer

00:f7:d3:58:68:16:5e:ad:8b:e4:b8:66:1e:b2:ff:cf:0d:62:3e:6c
Signer